Almost every cloud service a utility buys is multi-tenant: one platform, many customers. That is not a problem in itself — it is how the service can be run and kept up to date for a utility that could not run it alone. The question to ask is what keeps your records apart from the next customer’s, and whether the answer is a habit or a structure.
Three things to ask for in writing
- Separation on the plan you are actually buying. Some vendors offer isolation as a premium option. Ask what separates your data from other customers’ on the ordinary plan, because that is the plan most utilities are on. The honest answer describes something built in, not something configured.
- Your own keys. Ask whether the things that unlock your sessions and your documents are specific to your utility, so that something minted for one customer cannot be opened as another’s.
- Proof, not assurance. Ask whether the vendor has deliberately tried to make its own system leak one customer’s data to another — and what the result was, and how often it is repeated.
What the add-ons buy, and what they do not
A vendor may offer a dedicated database, or a dedicated environment that no other customer shares, sometimes with encryption keys the utility controls. These are worth having for utilities that want more physical separation, more predictable performance, or their own restore point. They should never be the thing that stops one customer reading another’s data; if the vendor’s basic plan relies on the add-on for that, the basic plan is the problem.
Two more questions
- Who at the vendor can see my data, when, and will I know? The answer should involve a stated reason, a time limit and a record you can read.
- What happens on the day I leave? You should receive everything, in a usable form, before anything is removed.
This is the standard IntelH2O holds itself to on every plan; the Security and trust page says so in plain words, and the mechanism is explained to your IT lead in person.